Ada has multiple guardrails built into the platform that prevent hallucination or rogue behavior. This includes a built-in final check that verifies each response against your approved knowledge sources and company context — non-compliant responses are blocked automatically before reaching the customer, reducing hallucination risk.

Ada also uses continuous red-teaming to ground every interaction in enterprise context and minimize hallucinations. System-level availability rules ensure the AI agent only leverages the right resources (Playbooks, Knowledge, etc.) for a given user and context.

Every conversation is continuously monitored and logged, so your team can audit accuracy and catch edge cases over time. We conduct annual penetration tests through authorized independent third parties that also include a thorough evaluation of the LLMs that power our AI agents.

AIUC-1 is the world's first industry standard specifically designed for AI agents. Think of it as a "SOC 2 for AI" — companies developing AI services can undergo independent, third-party audits to demonstrate compliance with established standards for governance and safety. It covers six essential pillars for AI trust and safety: safety, security, data & privacy, accountability, reliability, and societal impact.

Ada is a Founding Technical Contributor to AIUC-1 and the first CX company to achieve AIUC-1 certification. As a founding contributor, Ada partnered with AIUC to help shape the certification framework itself — providing input on technical safety measures and governance best practices.

To earn certification, Ada underwent a comprehensive independent review of its AI agent systems, practices, and policies, including more than 3,400 real-world tests across all six pillars.

SOC 2 and AIUC-1 cover different layers, and Ada holds both. SOC 2 Type II has become the industry standard for cybersecurity, and it verifies that an organization securely manages customer data to protect privacy and ensure the confidentiality, integrity, and availability of its systems over time. But it is not AI-specific.

AIUC-1 fills that gap. AIUC-1 is the world's first industry standard built specifically for AI agents, think of it as SOC 2 for AI. It evaluates AI systems across six pillars: Data & Privacy, Security, Safety, Reliability, Accountability, and Societal Impact.

Ada keeps AI responses on-brand and compliant through multiple built-in guardrails. A final check verifies each response against your approved knowledge sources and company context — blocking non-compliant responses automatically before they reach the customer.

System-level availability rules ensure the AI agent only accesses the right resources (Playbooks, Knowledge, etc.) for each user and context.

Ada also uses continuous red-teaming to ground every interaction in enterprise context and minimize hallucinations.

Ada's governance layer covers three ongoing disciplines:

1. Playbook governance: reviewing and updating AI workflows as products, policies, and regulations evolve
2. Performance monitoring: using the Performance Center to track resolution accuracy, escalation patterns, and response quality in real time
3. Audit and compliance logging: maintaining conversation-level records that support internal reviews and regulatory obligations.

You have complete oversight to configure, manage handoffs, test, analyze, and continuously optimize your AI agents. For enterprise teams, Ada provides both the tooling and the operational framework. Your team sets the governance cadence appropriate for your industry.

Yes. Ada enforces zero data retention (ZDR) with all LLM providers, meaning customer data is never stored or used to train third-party AI models.

Ada's platform includes built-in PII and PHI redaction, ensuring sensitive information such as financial data, personal identifiers, and health records is handled according to your configured data policies and is never exposed in analytics dashboards or third-party systems.

Secure authentication verifies customer identity before account-level data is accessed within a conversation. Enterprise-grade access controls and audit logs keep customer data protected end-to-end.

Ada holds SOC 2 Type II and HIPAA certifications and operates in compliance with GDPR. For financial services customers subject to FINRA or SEC record-keeping requirements, Ada's conversation logging and audit trail capabilities support compliance documentation.

Ada also aligns with AIUC-1, the first AI-specific compliance standard, and undergoes independent penetration testing at both the platform infrastructure and AI model layers. For organizations in healthcare, financial services, or insurance, Ada's security team provides a full compliance package on request.

Your organization retains full ownership of all data processed by Ada: customer conversations, knowledge base content, and interaction logs. Ada's enterprise agreement specifies data residency options, retention schedules, and deletion rights.

Ada does not share customer data across customers or use it for model training without explicit agreement. For organizations with data residency requirements, particularly those operating in the EU under GDPR or in regulated industries with jurisdiction-specific mandates, Ada's legal team engages directly to contractualize those requirements.

Ada provides full transparency into its data retention policies, clearly outlining what data is stored, for what purpose, and for how long. These policies are backed by rigorous data protection standards designed to ensure compliance with applicable privacy laws and regulations.

In addition, customers have direct control to delete personal data associated with specific identifiers, such as email addresses, enabling them to meet regulatory requirements.

For global deployments, data residency, retention schedules, and deletion rights are specified in your enterprise agreement, and Ada's legal team contractualizes jurisdiction-specific requirements directly.

Ada maintains a curated portfolio of models from leading vendors such as OpenAI, Anthropic, and Cohere. New LLMs are benchmarked across accuracy, safety, latency, and cost before selection. Updated versions pass a rigorous evaluation pipeline — proprietary tests, adversarial red-teaming, A/B trials, and phased rollouts with instant rollback.

All large language model (LLM) providers operate under Zero Data Retention (ZDR) agreements, ensuring customer data is never stored or reused by model providers. Prompts are processed only in volatile memory, and all inputs and outputs are discarded immediately after a response is generated. Customer data is never used for model training.

Yes, Ada is PCI DSS compliant. Enterprises with PCI requirements can confidently deploy Ada, unlocking a whole new category of use cases. Think retail transactions, flight bookings, subscription renewals — any moment where a customer needs to complete a payment transaction, across any channel.

Here's what this looks like in practice. A customer is engaging with your AI agent to book a flight, and it's time to pay. The cardholder data flows directly between the customer and your PCI-compliant processor — Ada never stores or touches it. The processor handles the transaction, and Ada picks right back up in the same conversation, confirming the booking and sending the customer a receipt.